EUVD-2026-29608
GHSA-h7wf-xq35-xj22
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open RCE: AV:L and UI:R because the victim must open a malicious file, PR:N as no auth is needed, and C/I/A:H reflecting arbitrary code execution in the user context.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Premiere Pro (versions 26.0.2, 25.6.4 and earlier) arises from an out-of-bounds write triggered when a victim opens a maliciously crafted project or media file, letting an attacker run code in the context of the current user. The flaw was reported by Adobe and addressed in advisory APSB26-46; it carries a CVSS 7.8 (High) score but a very low EPSS of 0.03%, and CISA SSVC records no observed exploitation. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Technical ContextAI
Adobe Premiere Pro is a professional non-linear video editing application that parses a wide range of project files and media container/codec formats. This vulnerability is a CWE-787 Out-of-bounds Write, meaning the application writes data past the bounds of an allocated buffer - typically because a length or index field parsed from an untrusted file is not properly validated before use. The tags 'Memory Corruption' and 'Buffer Overflow' align with this root cause. Memory corruption in a file parser of this kind can be leveraged to overwrite adjacent heap/stack structures and ultimately hijack control flow, yielding arbitrary code execution. The single affected CPE is cpe:2.3:a:adobe:premiere_pro:*, confirming Adobe Premiere Pro as the sole affected product.
RemediationAI
Update Adobe Premiere Pro to the fixed release listed in Adobe advisory APSB26-46 (https://helpx.adobe.com/security/products/premiere_pro/apsb26-46.html) - the vulnerable builds are 26.0.2 and 25.6.4 and earlier, so upgrade to the next Adobe-published version above these via the Creative Cloud desktop app; treat the advisory as the authoritative source for the exact patched build number since it is not restated in the raw CVE data. Until patched, the practical compensating control is to avoid opening Premiere Pro project or media files from untrusted or unverified sources, and to restrict inbound files to those from known collaborators, since exploitation requires a user to open a malicious file - the trade-off is workflow friction for teams that routinely ingest external assets. Enforcing least privilege (running editors as standard, non-administrative users) limits the blast radius of code executed in the user context but does not prevent the initial compromise.
More in Premiere Pro
View allArbitrary code execution in Adobe Premiere Pro stems from an out-of-bounds write (CWE-787) triggered when processing a s
Premiere Pro versions 25.1, 24.6.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could res
Arbitrary code execution in Adobe Premiere Pro (versions 26.0.2, 25.6.4 and earlier) stems from a Use-After-Free memory
Arbitrary code execution in Adobe Premiere Pro 26.0.2, 25.6.4 and all earlier versions arises from an out-of-bounds writ
Code execution in Adobe Premiere Pro 25.5 and earlier via out-of-bounds read when processing malicious media files. An a
Premiere Pro versions 25.0, 24.6.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could res
Premiere Pro versions 24.5, 23.6.8 and earlier are affected by an out-of-bounds write vulnerability that could result in
Premiere Pro versions 24.1, 23.6.2 and earlier are affected by an out-of-bounds write vulnerability that could result in
Premiere Pro versions 24.1, 23.6.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could res
Adobe Premiere Pro version 24.0 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability
Adobe Premiere Pro version 24.0 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability
Adobe Premiere Pro version 24.0 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds write vulnerabilit
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today